Do u think its a scam?

If you've already sent yr email then it's too late anyway. They probably just wanted to get into yr contact lists. Keep yr AV up to date & see what happens. In the mean time if you do on-line banking etc., just don't till you've got yr tunes card & then I would be going into the bank, using their PC & change yr p word & codes (just incase they've installed a key logger). Take care